PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-49034 Siemens CVE debrief

A Linux kernel vulnerability in the /proc/cpuinfo implementation that generates runtime warnings when specific debug configuration options are enabled. The issue occurs when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are both selected, causing cpu_max_bits_warn() to trigger warnings during cpuinfo display operations. This represents a local availability impact with medium severity.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Operators of Siemens industrial network infrastructure, OT security teams managing SCALANCE and RUGGEDCOM deployments, kernel maintainers for embedded industrial systems, and organizations with defense-in-depth ICS security requirements.

Technical summary

The vulnerability exists in the Linux kernel's /proc/cpuinfo implementation. When the kernel is compiled with both CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS configuration options enabled, the cpu_max_bits_warn() function generates runtime warnings during cpuinfo display operations. This is classified as CWE-20 (Improper Input Validation). The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, with high availability impact. The vulnerability affects Siemens industrial networking products including RUGGEDCOM RST2428P and SCALANCE switch families running vulnerable kernel configurations.

Defensive priority

medium

Recommended defensive actions

  • Review kernel configuration on affected Siemens devices to determine if CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled
  • Apply vendor-provided updates: update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT SSA-355557 for specific configuration guidance
  • Monitor system logs for cpu_max_bits_warn() runtime warnings as indicator of vulnerable configuration
  • Implement defense-in-depth strategies per CISA ICS recommended practices for industrial control systems
  • Restrict local access to affected devices to authorized personnel only
  • Validate kernel build configurations in device firmware prior to deployment

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. CISA ICS advisory ICSA-25-226-07 published same date. Siemens ProductCERT SSA-355557 advisory referenced as authoritative source. Advisory revised multiple times through February 2026 to correct affected products and clarify configurations.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-49034 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-49034

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-49034 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-49034

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.